Fetch Metadata headers let servers check request context before authorization

Web attacks often reach state-changing endpoints through request shapes the application never intended, such as cross-site forms or image loads. Fetch Metadata headers, including Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User, describe how a request was initiated so servers can screen it early. These headers are most useful at endpoints with a narrow expected context, but they do not replace authentication or CSRF tokens. The article recommends starting in monitoring mode to observe real traffic patterns before enforcing policies, since some legitimate clients may omit the headers. It also warns that proxies can strip or rewrite headers and that caching must account for variation on these values.